NIS2 Supplier Kit (EU) — does it reach me, self-assessment & customer questionnaire answers for small suppliers
Directive (EU) 2022/2555 ("NIS2") requires essential and important entities across the EU to run a duty of care across ten security areas (art. 21(2)) and — critically for you — to assess the cybersecurity practices of their own direct suppliers (art. 21(2)(d) and art. 21(3)). If you supply IT, software, hosting, consulting, facilities or any service to a company that falls under NIS2, you are very likely NOT regulated yourself, but you ARE the one they now have to ask security questions.
What's inside (7 files + bonus)
- "Does NIS2 reach me?" self-check (.xlsx) — a 5-question check for whether a customer's NIS2 duty reaches you, plus a transposition-status tab (4 verified member-state examples with dates, and the two official trackers for every other country).
- Self-assessment against the 10 measure areas of art. 21(2)(a)-(j) (.xlsx) — dropdown status, automatic score and priority.
- Lightweight security policy template (.docx) — fillable, structured along the same 10 areas.
- Incident-notification-to-customer procedure (.docx) — how and when to tell an affected customer, plus the statutory 24h/72h/1-month CSIRT timeline for the minority of suppliers who are themselves in scope.
- Questionnaire answer kit (.docx) — 8 security questions customers commonly ask, each with an honest sample answer for "in place" and "not yet in place".
- 1-page action plan (PDF).
- Read me first (.docx) — which parts matter most for you.
- Bonus: AI assistant — ready-made prompts to fill in the kit with Microsoft 365 Copilot, ChatGPT, Le Chat, Claude or Gemini, and to map a customer's questionnaire to your own answers, plus a Claude skill and instructions for your own GPT or Copilot agent. Anything you have not got is marked as a gap, never invented.
Need the underlying IT security policies too? The IT Policy Pack for Small Businesses (EU) (€39) covers acceptable use, passwords/MFA, remote work, backup and incident response with the same GDPR/NIS2/ISO 27001 mapping.
Mainly answering customer questionnaires? The full Security Questionnaire Answer Bank (63 questions, English + Dutch, €39) is available on its own.
Works in Word, Excel, Google Docs/Sheets and LibreOffice. Instant .zip download after purchase.
Who this is for
- Small suppliers of IT, software, hosting, consulting or facilities to a customer who falls under NIS2 — anywhere in the EU, not tied to one member state.
- Anyone who has already received (or expects) a customer security questionnaire, audit request or certification ask (ISO 27001, SOC 2 or similar).
- Freelancers and one-person businesses who want a fast, honest answer to "does this even reach me?" before spending time on a full compliance toolkit they likely don't need.
FAQ
- Am I directly regulated by NIS2?
- Most small suppliers are not themselves an essential or important entity under Directive (EU) 2022/2555. File 01's self-check gives a 5-minute indication either way; if you are active in a NIS2 sector yourself with roughly 50+ staff and €10m+ turnover or balance sheet total, check your national entity register or a lawyer — this kit flags that case but does not replace that check.
- Why would my customer ask ME security questions if I'm not regulated?
- Art. 21(3) requires an in-scope entity to consider the cybersecurity practices of its direct suppliers and service providers when applying its own supply-chain-security duty (art. 21(2)(d)) — regardless of your own size. That obligation is theirs, but answering their questions well is now a common commercial expectation.
- Is this legal advice?
- No. This is a template, not legal advice — no guarantee of full legal compliance, and no determination of whether your organisation is itself in scope. Check your national entity register/transposition law or a lawyer if in doubt.
- Which software does this work in?
- Standard .docx/.xlsx/.pdf files — opens in Word, Excel, Google Docs/Sheets and LibreOffice, no special software required.
- Does this use fear marketing or fine amounts to sell itself?
- No. No fine amounts are used as a sales argument anywhere in this kit. Every legal/factual claim is listed with its source in the "Sources" section of the Read-me.
Further reading (free articles)
Template, not legal advice. No guarantee of full legal compliance, and no determination of whether your organisation is itself in scope — check your national entity register/transposition law or a lawyer if in doubt. Based on Directive (EU) 2022/2555, Commission Implementing Regulation (EU) 2024/2690 (for the small set of digital-infrastructure entities it actually applies to), and verified national transposition examples — source list in the Read-me. Prepared with the help of AI under the direction of Lerider Technologies and checked against its factual/legal references before publication.
Refunds: if this kit isn't useful for you, email within 14 days of purchase for a full refund, no questions asked.
At checkout you accept our terms (Dutch, with an English summary). See also refunds and privacy.